<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How find the cifs audit logs? in ONTAP Discussions</title>
    <link>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59345#M13925</link>
    <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;It is on only.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Is there any effect to reduce the snap reserve space &lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
    <pubDate>Wed, 09 Apr 2014 16:17:45 GMT</pubDate>
    <dc:creator>YASWANTHREDDY</dc:creator>
    <dc:date>2014-04-09T16:17:45Z</dc:date>
    <item>
      <title>How find the cifs audit logs?</title>
      <link>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59333#M13922</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;we got request form user to increase the space for the share drive.&amp;nbsp; we don't have space in aggregate. so we reduce the snap reserve space for the volume.&amp;nbsp; &lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;After 2 days we got one more request from user&amp;nbsp; it seems as though since the capacity has been increased for the below share drive, people are now noticing that some of their information is missing.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;1. Is there any effect to reduce the snap reserve space on user data?&lt;/P&gt;&lt;P&gt;2. How find the who his delete the folders in share drive?&lt;/P&gt;&lt;P&gt;3.&amp;nbsp; I checked the rdfile /etc/log/audit&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;usdanrmmd1na006&amp;gt; rdfile /etc/log/auditlog.1 &lt;/P&gt;&lt;P&gt;Sun Mar 23 04:07:55 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Sun Mar 23 04:07:55 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Sun Mar 23 04:07:56 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Sun Mar 23 16:50:47 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Sun Mar 23 16:50:47 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Sun Mar 23 16:50:47 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Mon Mar 24 04:08:21 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Mon Mar 24 04:08:21 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Mon Mar 24 04:08:21 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Mon Mar 24 16:48:53 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Mon Mar 24 16:48:54 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Mon Mar 24 16:48:54 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Tue Mar 25 04:07:46 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Tue Mar 25 04:07:46 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Tue Mar 25 04:07:47 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:36:33 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_52751]:password &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:36:39 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:cifs shares &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:36:50 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:cifs shares MS112Home &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:37:01 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:cifs sessions show &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:38:53 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:vol status /vol/philips_vol013_cifs_MS112Home/MS112HomeQT &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:39:00 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:vol status /vol/philips_vol013_cifs_MS112Home/ &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:39:10 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snap list /vol/philips_vol013_cifs_MS112Home/MS112HomeQT &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:39:26 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snap list philips_vol013_cifs_MS112Home &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:40:00 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snapvault status /vol/philips_vol013_cifs_MS112Home/MS112HomeQT &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:40:18 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:snapmirror:snapmirror status &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:41:08 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snapvault snap sched /vol/philips_vol013_cifs_MS112Home/MS112HomeQT &lt;/P&gt;&lt;P&gt;Tue Mar 25 14:41:38 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snapvault snap sched philips_vol013_cifs_MS112Home &lt;/P&gt;&lt;P&gt;Tue Mar 25 15:09:34 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell: &lt;/P&gt;&lt;P&gt;Tue Mar 25 15:09:35 EDT last message repeated 4 times &lt;/P&gt;&lt;P&gt;Tue Mar 25 15:09:40 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:exportfs &lt;/P&gt;&lt;P&gt;Tue Mar 25 15:36:06 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_52751]:END:ssh2 shell: &lt;/P&gt;&lt;P&gt;Tue Mar 25 15:50:01 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_53400]:password &lt;/P&gt;&lt;P&gt;Tue Mar 25 15:50:03 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_53400]:IN:console shell:exit &lt;/P&gt;&lt;P&gt;Tue Mar 25 15:50:06 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_53400]:END:ssh2 shell: &lt;/P&gt;&lt;P&gt;Tue Mar 25 16:50:36 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Tue Mar 25 16:50:37 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Tue Mar 25 16:50:37 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Wed Mar 26 04:08:09 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Wed Mar 26 04:08:09 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Wed Mar 26 04:08:09 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:41:55 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_58014]:password &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:41:59 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:42:23 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:cifs shares share5$ &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:43:16 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h Share5 &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:43:30 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share5 &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:43:37 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share5 15 &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:43:42 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share5 &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:43:52 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h Share5 &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:45:14 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:cifs shares &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:46:27 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h Share6 &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:46:44 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share6 &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:46:48 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share6 15 &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:46:53 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share6 &lt;/P&gt;&lt;P&gt;Wed Mar 26 09:47:00 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h Share6 &lt;/P&gt;&lt;P&gt;Wed Mar 26 10:02:10 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 10:02:10 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 10:02:13 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:exit &lt;/P&gt;&lt;P&gt;Wed Mar 26 10:02:15 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_58014]:END:ssh2 shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 10:07:26 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_58450]:password &lt;/P&gt;&lt;P&gt;Wed Mar 26 10:07:30 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58450]:IN:console shell:df -h &lt;/P&gt;&lt;P&gt;Wed Mar 26 10:33:08 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58450]:IN:console shell:exit &lt;/P&gt;&lt;P&gt;Wed Mar 26 10:33:10 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_58450]:END:ssh2 shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 14:23:33 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_61656]:password &lt;/P&gt;&lt;P&gt;Wed Mar 26 14:23:38 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61656]:IN:console shell:exportfs &lt;/P&gt;&lt;P&gt;Wed Mar 26 15:08:53 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61656]:IN:console shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 15:08:53 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61656]:IN:console shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 15:08:56 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61656]:IN:console shell:exit &lt;/P&gt;&lt;P&gt;Wed Mar 26 15:09:00 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_61656]:END:ssh2 shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:31:20 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_63208]:password &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:31:24 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:date &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:31:28 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:cifs shares &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:31:43 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:snapvault status /vol/philips_vol013_cifs_MS112Home/MS112HomeQT &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:32:02 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:sanpvault status &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:32:12 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:snapvault:snapvault status &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:32:16 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:32:35 EDT last message repeated 4 times &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:32:39 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:snapvault:snapvault &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:33:01 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:33:07 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:snap:snap list &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:40:42 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:40:43 EDT last message repeated 3 times &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:40:44 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:exit &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:40:46 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_63208]:END:ssh2 shell: &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:49:50 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:49:51 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Wed Mar 26 16:49:51 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 04:07:36 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Thu Mar 27 04:07:37 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 04:07:37 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 12:57:17 EDT [usdanrmmd1na006: HTTPPool00:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 12:57:22 EDT [usdanrmmd1na006: HTTPPool03:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 12:57:28 EDT [usdanrmmd1na006: HTTPPool01:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 12:57:32 EDT [usdanrmmd1na006: HTTPPool04:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 12:57:35 EDT [usdanrmmd1na006: HTTPPool00:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 12:57:37 EDT [usdanrmmd1na006: HTTPPool03:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:39:03 EDT [usdanrmmd1na006: HTTPPool00:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:39:22 EDT [usdanrmmd1na006: HTTPPool02:debug]: sysadm:HTTP:/na_admin/ &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:39:22 EDT [usdanrmmd1na006: rshd_0:debug]: sysadm:START:rsh shell:[127.0.0.1_59755] &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:39:22 EDT [usdanrmmd1na006: rshd_0:debug]: sysadm@[127.0.0.1_59755]:IN:rsh shell:RSH INPUT COMMAND is priv set -q admin ; version &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:39:22 EDT [usdanrmmd1na006: rshd_0:debug]: sysadm@[127.0.0.1_59755]:END:rsh shell: &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:43:17 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.142_63766]:password &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:43:37 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:cifs share Share1$ &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:43:42 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:cifs share Share1 &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:43:55 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:cifs shares Share1$ &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:44:17 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:df -h /vol/Share1/Share1QT &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:45:19 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:cifs shares Share6$ &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:45:31 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:exit &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:45:34 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.142_63766]:END:ssh2 shell: &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:57:27 EDT [usdanrmmd1na006: sshd_1:debug]: sysadm:START:ssh2 shell:[161.88.16.141_64926]:password &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:57:48 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_64926]:IN:console shell:cifs shares Share1$ &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:58:08 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_64926]:IN:console shell:snapvault status /vol/Share1/ &lt;/P&gt;&lt;P&gt;Thu Mar 27 13:58:26 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_64926]:IN:console shell:snapvault status /vol/Share1/Share1QT &lt;/P&gt;&lt;P&gt;Thu Mar 27 14:57:19 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_64926]:END:ssh2 shell: &lt;/P&gt;&lt;P&gt;Thu Mar 27 16:50:32 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Thu Mar 27 16:50:32 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Thu Mar 27 16:50:32 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Fri Mar 28 04:08:34 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Fri Mar 28 04:08:34 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Fri Mar 28 04:08:35 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Fri Mar 28 16:50:09 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Fri Mar 28 16:50:10 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Fri Mar 28 16:50:10 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Sat Mar 29 04:08:06 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Sat Mar 29 04:08:06 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Sat Mar 29 04:08:06 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Sat Mar 29 16:49:55 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated" &lt;/P&gt;&lt;P&gt;Sat Mar 29 16:49:55 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Sat Mar 29 16:49:56 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist" &lt;/P&gt;&lt;P&gt;Sat Mar 29 23:22:12 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_61523]:password &lt;/P&gt;&lt;P&gt;Sat Mar 29 23:22:43 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61523]:IN:console shell:snapmirror status &lt;/P&gt;&lt;P&gt;Sat Mar 29 23:22:49 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61523]:IN:console shell:snapvault status &lt;/P&gt;&lt;P&gt;Sat Mar 29 23:22:56 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61523]:IN:console shell:qtree status &lt;/P&gt;&lt;P&gt;Sat Mar 29 23:25:03 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61523]:IN:console shell:exit &lt;/P&gt;&lt;P&gt;Sat Mar 29 23:25:06 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_61523]:END:ssh2 shell: &lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Please help us on this.. User is blaming me .. how can i prove there is no problem from our end.&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Thu, 05 Jun 2025 05:38:32 GMT</pubDate>
      <guid>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59333#M13922</guid>
      <dc:creator>YASWANTHREDDY</dc:creator>
      <dc:date>2025-06-05T05:38:32Z</dc:date>
    </item>
    <item>
      <title>Re: How find the cifs audit logs?</title>
      <link>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59339#M13924</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;There is no CIFS auditing unless you enabled it.&amp;nbsp; The default is off.&amp;nbsp; You can check this by typing options cifs.audit.enable to see if it's on or off.&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Wed, 09 Apr 2014 15:19:03 GMT</pubDate>
      <guid>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59339#M13924</guid>
      <dc:creator>resqme914</dc:creator>
      <dc:date>2014-04-09T15:19:03Z</dc:date>
    </item>
    <item>
      <title>Re: How find the cifs audit logs?</title>
      <link>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59345#M13925</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;It is on only.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Is there any effect to reduce the snap reserve space &lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Wed, 09 Apr 2014 16:17:45 GMT</pubDate>
      <guid>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59345#M13925</guid>
      <dc:creator>YASWANTHREDDY</dc:creator>
      <dc:date>2014-04-09T16:17:45Z</dc:date>
    </item>
    <item>
      <title>Re: How find the cifs audit logs?</title>
      <link>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59351#M13926</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;Reducing the aggregate or volume snap reserve space should not cause you to lose files.&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Wed, 09 Apr 2014 16:38:31 GMT</pubDate>
      <guid>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59351#M13926</guid>
      <dc:creator>resqme914</dc:creator>
      <dc:date>2014-04-09T16:38:31Z</dc:date>
    </item>
    <item>
      <title>Re: How find the cifs audit logs?</title>
      <link>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59356#M13927</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;Snap reserve is space reserved for snapshot so there is no point that reducing it cause data loss .&lt;/P&gt;&lt;P&gt;Secondly as a storage admin you cant find who has deleted the file on share level because you dont have any auditing for this .&lt;/P&gt;&lt;P&gt;If the user is complaining for data loss check for snapshot and try to restore.&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Thu, 10 Apr 2014 06:08:01 GMT</pubDate>
      <guid>https://community.netapp.com/t5/ONTAP-Discussions/How-find-the-cifs-audit-logs/m-p/59356#M13927</guid>
      <dc:creator>SANJESHUF</dc:creator>
      <dc:date>2014-04-10T06:08:01Z</dc:date>
    </item>
  </channel>
</rss>

